question: How to set the callback and redirect URI?

[simaotwx]

This is probably already answered or at least discussed in https://github.com/greenpau/caddy-auth-portal/issues/193 however, the issues are no longer visible.

I'd like to change the callback URL in this plugin to avoid changing it in the provider as in enterprises this is often a process which takes time and approvals to get through.

Example:

Instead of /auth/oauth2/example/authorization-code-callback just /callback

Is this possible or does it need to be implemented?

There are two parts that would need to cooperate here:

The redirect_uri parameter when redirecting to the provider as well as the route in Caddy to listen on /callback (or any other custom URL).

[greenpau]

@simaotwx , thank you for the question! 👍 it needs to be implemented.

[simaotwx]

Thank you for the quick response. Looking forward to it!

[tomberek]

I'm running into this as well. My use-case is when running caddy behind another reverse-proxy for and the "localhost" of the caddy binding is being injected as the redirect_uri, rather than the indented public uri. I've tried various trick and look through the code to see if there is a workaround via Host headers; but no luck yet.

• x-forwarded-for?
• host?
• base_url?
• https://github.com/greenpau/go-authcrunch/blob/be81fe63fd665f9ae1aad6e79643c2f9c3fce653/pkg/idp/oauth/authenticate.go#L101

Edit: seems like judicious application of X-Forwarded-* headers works.

[roblabla]

I have a somewhat similar need. I am using caddy-l4 using the new listener_wrapper module, which allows sharing the 443 port with multiple services (tls or caddy).

The problem is, because caddy-l4 terminates TLS, caddy-authp gets confused and sets the redirect URL using http instead of https (ergo the redirect URL is set to http://mydomain/auth/oauth2/github/authorization-code-callback). This is obviously not what I want, and as thus, it fails.

EDIT: Found a solution to my problem on the caddy-l4 side by not terminating TLS.

[aboisvert]

I was also getting the Google OAuth2 "request_uri mismatch" error due to the request_uri passing http instead of https.

I'm noting the solution that worked for me, as suggested by @tomberek above. Simply adding the 'X-Forwarded-Proto: https' header on my upstream reverse proxy, which happens to be opnsense, made everything work.